Cathay Pacific, British Airways, easyJet – what’s the connection?

In March 2020 Cathy Pacific was fined £500,000, the maximum under the pre-GDPR law, for various security defects which enabled a hacker to gain access between 2014 and to the personal data of over 9.4 million customers worldwide. In July 2019 The ICO served notice on BA that intended to impose a fine of over £180 million, representing 1.5% of worldwide turnover, for customer data being diverted to a false site affecting over 500,000 customers. BA are contesting this. Now in May 2020 easyJet has announced that a sophisticated cyber attack has resulted in the email and travel details of around 9 million customers (Including credit card details for a small number) being compromised. This seems to have been discovered in January but at present it is not known exactly when the attack took place.

Another common feature is that these are all large consumer service businesses which are expected to apply the very highest standards of data security, so any lapse resulting in a breach, even if it is claimed that it could not have been anticipated, is likely to meet with little sympathy. easyJet’s total revenue in 2019 was £6.4 billion, so a 1.5% fine, similar to BA, would be £96 million.

An interesting question is whether, in addition to the mitigating factors of levels of security applied, diligence in investigation and cooperation with the ICO, any additional mitigation will result from the Covid-19 pandemic resulting in airline travel being decimated. The argument will no doubt be made, but as several commentators have highlighted, that logic would suggest that in times where the airline was enjoying strong performance, the fine should be increased.

Whatever approach the ICO decides to take, easyJet can expect any fine to be significant. This clearly comes at a very unwelcome time for the airline, given the state of the industry – and its outlook over the next 12-24 months – but compared to many of its peers, easyJet appears to be in a fair condition financially (relatively speaking). Having reportedly drawn down £600m in loans from the Bank of England, and deferred contracts for new aircraft, to shore-up its cash position, a modest number of domestic flights are scheduled to re-start in June.

The fact that this announcement has only just been made and a full investigation by the ICO has not yet got underway may be ominous – in these circumstances it is often the case that the extent of the breach turns out to be worse rather than better than was originally reported. This data breach story therefore seems to have a long way to go yet.